Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-10643: Zephyr can corrupt memory on small recvmsg buffers
CVE-2026-10643 · published 4 months ago
Summary
The Zephyr operating system’s network code can write past the end of a buffer when a program receives data with a control buffer that is too small. This can corrupt memory and be triggered by an unprivileged application using UDP sockets. Update Zephyr to a version newer than 4.4.0 or ensure control buffers are sized correctly.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zephyrproject | zephyr |
>= 3.6.0, <= 4.4.1 < 4.5.0 < 4.4.2 cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* |
Original advisory text
Out-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_pktinfo` undersizes the control-buffer capacity check)
Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffer using only the payload length (msg->msg_controllen < pktinfo_len) before writing a full control message consisting of an aligned cmsg header plus the payload. Because the check omitted the cmsg header size, a control buffer whose length falls in the under-checked window (e.g. 16-27 bytes for IPv4 IP_PKTINFO on a 64-bit target, where a single element actually occupies 28 bytes) passes the guard yet causes a fixed-size out-of-bounds write of up to one cmsg header (~12 bytes) past the end of the buffer.
Under CONFIG_USERSPACE the recvmsg verifier allocates a kernel-heap copy of the control buffer sized to msg_controllen and runs the implementation against it, so the overflow corrupts kernel heap memory and is triggerable from an unprivileged userspace thread; in supervisor mode it corrupts the caller's buffer.
The path is reachable on a UDP/IP socket with IP_PKTINFO/IPV6_RECVPKTINFO (or hoplimit/timestamping) enabled when the application calls recvmsg() with an undersized control buffer and a datagram is received; part of the overwritten bytes (the destination IP in ipi_addr) is influenced by the received packet.
The fix makes the capacity check use NET_CMSG_SPACE(pktinfo_len) (aligned header + aligned data) and returns -ENOMEM when the buffer is too small. Affected: v3.6.0 through v4.4.0.
Under CONFIG_USERSPACE the recvmsg verifier allocates a kernel-heap copy of the control buffer sized to msg_controllen and runs the implementation against it, so the overflow corrupts kernel heap memory and is triggerable from an unprivileged userspace thread; in supervisor mode it corrupts the caller's buffer.
The path is reachable on a UDP/IP socket with IP_PKTINFO/IPV6_RECVPKTINFO (or hoplimit/timestamping) enabled when the application calls recvmsg() with an undersized control buffer and a datagram is received; part of the overwritten bytes (the destination IP in ipi_addr) is influenced by the received packet.
The fix makes the capacity check use NET_CMSG_SPACE(pktinfo_len) (aligned header + aligned data) and returns -ENOMEM when the buffer is too small. Affected: v3.6.0 through v4.4.0.
References
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pvf7-7mrp-...
- https://github.com/zephyrproject-rtos/zephyr/commit/01fe77b2ec3885583f709a17c520... patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10643... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-10643 Vendor Advisory
- https://github.com/zephyrproject-rtos/zephyr Product
- https://github.com/zephyrproject-rtos/zephyr/commit/91db82a245b731166c547a598029... patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-787Out-of-bounds Write
Timeline
Published27 Jun 2026
Updated4 Nov 2026
First seen29 Jun 2026
Track software like this
Free during beta